Goth Anime Girl Monochrome Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality weak.

The extension "Goth Anime Girl Monochrome Live Wallpaper" (version 1.1.3) published by [email protected] generates 721 total findings, but the nature of these findings indicates widespread false positive detection rather than malicious behavior.

The 565 IoC findings are overwhelmingly benign or false positives. Legitimate social media domains dominate: www.reddit.com, www.instagram.com, twitter.com, discord.com, and open.spotify.com appear in the findings, which are common in many extensions for various purposes. More critically, the IoC extractor has misread JavaScript property access chains as domains: se.call, ce.map, ae.call, k.call, and bg.mp are clearly false positives per the documented XIOC extractor garbage patterns. Only two domains raise questions: dekuy.com and t.top, which lack additional context or malware signature correlation.

The 156 code-smell findings (marked as high severity) are expected noise. Per the CVEQ guidelines, code-smell rules like postinstall_*, credential_*, and code-quality rules "fire on almost any non-trivial JavaScript" and "should NEVER drive a verdict." These findings reflect the presence of standard JavaScript patterns, not malicious intent.

Crucially, there are zero malware-signature findings, zero malware findings, zero obfuscation findings, and zero network findings. This absence of actual malicious indicators is decisive. The extension description matches its name (a live wallpaper), showing no evidence of typosquatting, browser hijacking, credential theft, or malware delivery disguise.

Strongest counterargument: A skeptic would point to the anonymous Gmail developer address and the two unknown domains (dekuy.com, t.top) as potential data exfiltration endpoints. However, without malware signatures, obfuscation, or evidence of suspicious network behavior, these unknown domains could legitimately be CDNs, analytics services, or the extension's own infrastructure. The absence of any high-confidence threat indicators (malware signatures, credential access patterns, browser hijacking code) means the evidence does not support a confirmed_malicious verdict. Runtime analysis would clarify the purpose of these domains, but the current evidence bundle is dominated by known false positive patterns.

Key Reasons

• Zero malware signatures and zero obfuscation findings
• IoC findings dominated by legitimate social media domains and property access chain false positives
• Code-smell findings are documented false positive patterns
• Extension description matches its stated purpose (live wallpaper)

False Positive Considerations

• IoC extractor property access chain false positives (se.call, ce.map, ae.call, k.call, bg.mp)
• Code-smell findings that fire on non-trivial JavaScript
• Legitimate social media domains misclassified as suspicious IoCs
• High finding counts from bundled dependencies

Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 70%.